Roundcube known exploited vulnerabilities
The Beam CVE database tracks 11 known exploited vulnerabilities for Roundcube: 3 critical, 2 high and 6 medium severity. The newest is CVE-2025-68461, published Dec 18, 2025.
These are the Roundcube vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog: flaws with confirmed exploitation in the wild. Each entry links the vendor bulletin and CISA’s required action.
- Vulnerabilities tracked
- 11
- Critical
- 3
- Known exploited (CISA KEV)
- 11
- Published in the last 30 days
- 0
All entries, newest first
CVE-2025-68461
RoundCube Webmail Cross-site Scripting Vulnerability
medium6.1ExploitedDec 18, 2025CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
high8.8ExploitedJun 2, 2025CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
critical9.3ExploitedAug 5, 2024CVE-2024-37383
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
medium6.1ExploitedJun 7, 2024CVE-2023-5631
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
medium5.4ExploitedOct 18, 2023CVE-2023-43770
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
medium6.1ExploitedSep 22, 2023CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
critical9.8ExploitedNov 19, 2021CVE-2020-35730
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
medium6.1ExploitedDec 28, 2020CVE-2020-13965
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
medium6.1ExploitedJun 9, 2020CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
critical9.8ExploitedMay 4, 2020CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability
high7.8ExploitedNov 9, 2017
